PT-2020-5467 · Intel+6 · Dpdk+6

Published 2020-05-18 · Updated 2024-06-15 · CVE-2020-10725

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DPDK versions 19.11 and above

Description A flaw in DPDK allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, resulting in a loss of connectivity for other guests. This issue is caused by a missing validity check of the descriptor address in the function virtio dev rx batch packed(). The flaw is related to an integer overflow.

Recommendations For DPDK versions 19.11 and above, consider disabling the virtio dev rx batch packed() function until a patch is available to prevent exploitation. Restrict access to the vhost-user backend application to minimize the risk of connectivity loss for other guests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALT-PU-2020-2878

ALT-PU-2021-1176

ALT-PU-2021-2053

BDU:2021-00723

CESA-2020_4806

CVE-2020-10725

OPENSUSE-SU-2020:0693-1

OPENSUSE-SU-2020_0693-1

OPENSUSE-SU-2024:10727-1

RHSA-2020:2295

RHSA-2020:4806

RHSA-2020_4806

RHSA-2021:1239

SUSE-SU-2020:1334-1

SUSE-SU-2020:1335-1

USN-4362-1

Affected Products

Alt Linux

Centos

Dpdk

Linuxmint

Red Hat

Suse

Ubuntu

References · 45

• https://bugs.dpdk.org/show_bug.cgi?id=270 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://ubuntu.com/security/CVE-2020-10723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10724 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4362-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10725 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10725 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4362-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4806.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00723 · Security Note
• https://ubuntu.com/security/CVE-2020-10725 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1335-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10727-1 · Vendor Advisory